(deploy): every change-set deployment prints "Changeset ... created and waiting in review for manual execution (--no-execute)" although the change set is executed

[go-to-k]

Describe the bug

Since #1273, every cdk deploy that uses the default change-set method and has actual changes prints:

MyStack: creating CloudFormation changeset...
Changeset arn:aws:cloudformation:...:changeSet/cdk-deploy-change-set/... created and waiting in review for manual execution (--no-execute)
...
✅  MyStack

The message claims the change set is waiting for manual execution, but the change set is executed right after (the deployment completes and describe-change-set shows ExecutionStatus: EXECUTE_COMPLETE). --no-execute was never requested. Display-only issue; the deployment itself works.

Cause:

• Since fix(cli): use change set for deploy approval diff when using change-set method #1273, the deploy action always creates the change set upfront to get an accurate diff for the approval prompt: it calls Deployments.prepareStack(), which internally forces execute: false, and then executes the prepared change set in a second phase (https://github.com/aws/aws-cdk-cli/blob/main/packages/%40aws-cdk/toolkit-lib/lib/toolkit/toolkit.ts — "When using change-set method, always create the change set upfront").
• deploy-stack.ts prints the "waiting in review for manual execution (--no-execute)" message whenever execute is false (https://github.com/aws/aws-cdk-cli/blob/main/packages/%40aws-cdk/toolkit-lib/lib/api/deployments/deploy-stack.ts#L486-L488). It cannot distinguish the internal first phase of an executing deployment from a user-requested --no-execute, so the message is printed for every change-set deployment with changes.

This also surfaces in flows that deploy internally, e.g. the finalizing deployment after cdk import ("Finish with a cdk deploy now?"), which is how I originally noticed it.

#1273 first shipped in aws-cdk 2.1118.1. I reproduced the message with a plain cdk deploy (a simple stack update, no flags besides --require-approval never) on 2.1135.0.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

2.1118.0

Expected Behavior

The "waiting in review for manual execution (--no-execute)" message is only printed when the created change set is actually left unexecuted, i.e. when the user asked for it (--method=prepare-change-set / --no-execute variants, including cdk import --no-execute).

Current Behavior

The message is printed on every change-set deployment that has changes, and then the change set is executed anyway.

Reproduction Steps

1. Deploy any stack.
2. Change something in the stack and run cdk deploy again (default change-set method).
3. Observe the Changeset ... created and waiting in review for manual execution (--no-execute) line, followed by the deployment executing and succeeding.

Possible Solution

Only the caller knows whether execute: false is user-requested or the internal first phase of an executing deployment. Move the announcement out of deploy-stack.ts to the places where that intent is known: Deployments.prepareStack() (which already receives this distinction via cleanupOnNoOp) and the resource importer (for cdk import --no-execute).

I will submit a PR for this.

Additional Information/Context

No response

CDK CLI Version

2.1135.0

Framework Version

2.261.0

Node.js Version

24.19.0

OS

macOS 15

Language

TypeScript

Language Version

No response

Other information

No response

[9pace]

Thank you for identifying this issue! I have added my review on the linked PR.